# Root Cause Analysis — CVE-2024-30085 ## Metadata | Field | Value | |---|---| | **CVE** | CVE-2024-30085 | | **Binary** | cldflt.sys (Windows Cloud Files Mini Filter Driver) | | **Severity** | Important (CVSS 7.8) | | **Impact** | Elevation of Privilege | | **Bug Class** | CWE-122: Heap-based Buffer Overflow | | **Patch** | KB5039211 (June 2024) | | **Discoverers** | Alex Birnberg (SSD Secure Disclosure), Gwangun Jung & Junoh Lee (Theori) | ## 1. Executive Summary CVE-2024-30085 is a heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver (`cldflt.sys`). The `HsmIBitmapNORMALOpen` function allocates a fixed 0x1000-byte pool buffer (`HsBm` tag) but copies user-controlled reparse data without validating that the copy size does not exceed the allocation. An attacker who registers a cloud sync root and crafts a file with malicious reparse data can overflow the paged pool, corrupt adjacent allocations, and escalate to SYSTEM. ## 2. Vulnerable Function **HsmIBitmapNORMALOpen** in `cldflt.sys` ### Pre-patch pseudocode ```c if (local_70 == 0x0) || (0xffe < memcpy_size - 1) { Dst = ExAllocatePoolWithTag(PagedPool, 0x1000, 'HsBm'); if (Dst == NULL) { /* error */ } memcpy(Dst, local_70, memcpy_size); // BUG: no size check } else { iVar13 = *(int *)((memcpy_size - 4) + (longlong)local_70); if (iVar13 == -1 && memcpy_size == 4) { *(uint *)(Dst + 2) = *(uint *)(Dst + 2) | 0x10; } else { Dst = ExAllocatePoolWithTag(PagedPool, 0x1000, 'HsBm'); if (Dst == NULL) { /* error */ } } memcpy(Dst, local_70, memcpy_size); // BUG: memcpy_size can exceed 0x1000 } ``` ### Post-patch addition ```c if (((int)uVar7 != 0) && (0x1000 < memcpy_size)) { HsmDbgBreakOnStatus(STATUS_BUFFER_OVERFLOW); // error path - reject oversized copies } ``` ## 3. Root Cause The `memcpy_size` variable derives from the `Length` field of the `_HSM_DATA` structure embedded within the cloud filter reparse point. This field is fully user-controlled via `FSCTL_SET_REPARSE_POINT_EX`. While validation functions (`HsmpRpValidateBuffer`, `HsmpBitmapIsReparseBufferSupported`) check element types, counts, and offsets, **no function validates that the total data length fits within the 0x1000-byte allocation before calling memcpy**. The allocation is always fixed at 0x1000 bytes (paged pool, tag `HsBm`), but the copy size can be up to 0xFFFF (16-bit `Length` field in `HSM_DATA`). This creates an overflow of up to ~0xEFFF bytes. ## 4. Reachability / Attack Surface ### Call chain ``` Attacker opens file in sync root directory -> NTFS post-create callback -> HsmFltPostCREATE -> HsmiFltPostECPCREATE -> HsmpSetupContexts -> HsmpCtxCreateStreamContext -> HsmIBitmapNORMALOpen -> memcpy(HsBm_buffer, reparse_data, user_controlled_size) // OVERFLOW ``` ### Prerequisites 1. Register a sync root via `CfRegisterSyncRoot()` (Cloud Files API, low privilege) 2. Create a file in the sync root directory 3. Set reparse point with `FSCTL_SET_REPARSE_POINT_EX` using tag `IO_REPARSE_TAG_CLOUD_6` (0x9000601A) 4. Craft reparse data with nested `FeRp` and `BtRp` structures passing all element-type validation checks 5. Reopen the file to trigger the post-create code path ### Privilege required Low (any authenticated user). No special group membership needed. ## 5. Reparse Data Structure ``` REPARSE_DATA_BUFFER ├─ ReparseTag: IO_REPARSE_TAG_CLOUD_6 (0x9000601A) ├─ ReparseDataLength └─ DataBuffer[] └─ HSM_REPARSE_DATA ├─ Flags: 0x8001 (compressed) or 0x0001 (raw) ├─ Length └─ HSM_DATA (FeRp) ├─ Magic: "FeRp" (0x70526546) ├─ CRC32 (if Flags & 0x2) ├─ Length (controls memcpy_size) ├─ NumberOfElements (< 0xA) ├─ Elements[0]: Type BYTE (0x07) ├─ Elements[1]: Type UINT32 (0x0A) ├─ Elements[2]: Type UINT64 (0x06) ├─ Elements[4]: Type BITMAP (0x11) │ └─ HSM_DATA (BtRp) │ ├─ Magic: "BtRp" (0x70527442) │ ├─ Elements[0]: Type BYTE │ ├─ Elements[1]: Type BYTE (value 0x1) │ ├─ Elements[2]: Type BYTE │ ├─ Elements[3]: Type UINT64 │ └─ Elements[4]: Type BITMAP (overflow data here) ``` ## 6. Exploitation (STAR Labs — Cherie-Anne Lee) Full working exploit published at https://github.com/star-sg/CVE/tree/master/CVE-2024-30085 ### Strategy (two-trigger approach) 1. **First trigger**: Overflow HsBm into adjacent `_WNF_STATE_DATA` object (paged pool 0x1000 allocation). Corrupt `DataSize` from 0xFF0 to 0xFF8, gaining 8-byte OOB read/write. 2. **ALPC handle table spray**: Spray `_ALPC_HANDLE_TABLE` objects (0x1000 size) to reclaim freed WNF holes. Read from corrupted WNF leaks `_KALPC_RESERVE` pointer. 3. **Second trigger**: Overflow into another `_WNF_STATE_DATA` adjacent to a `PipeAttribute` object. Corrupt PipeAttribute's `Flink` to point to fake PipeAttribute in user-mode (SMAP not enabled on Windows). 4. **Arbitrary read**: Walk fake PipeAttribute chain to read `EPROCESS` → `Token` address via ALPC port → OwnerProcess. 5. **Arbitrary write**: Overwrite `_KALPC_RESERVE` pointer in ALPC handle table (via first WNF) to point to fake `_KALPC_RESERVE` → fake `_KALPC_MESSAGE`. Set `ExtensionBuffer` = token privileges address, `ExtensionBufferSize` = 0x10, then call `NtAlpcSendWaitReceivePort` to write 0xFFFFFFFFFFFFFFFF (all privileges enabled). 6. **SYSTEM shell**: Open winlogon.exe process handle → `CreateProcess` with that handle → NT AUTHORITY\SYSTEM. ### Pool layout - Paged pool 0x1000-size bucket - WNF spray: 0x450 `_WNF_STATE_DATA` objects (DataSize=0xFF0 → total 0x1000) - Free every alternate WNF to create holes - Trigger overflow reclaims one hole, corrupts adjacent WNF ## 7. Detection ### Crash signature BSOD `KERNEL_DATA_INPAGE_ERROR` or `PAGE_FAULT_IN_NONPAGED_AREA` when corrupted WNF/ALPC data is accessed. Pool tag `HsBm` with allocation 0x1000 followed by corruption of adjacent pool chunks. ### YARA rule ```yara rule CVE_2024_30085_cldflt_heap_overflow { meta: description = "Detects exploit artifacts for CVE-2024-30085 (cldflt.sys heap overflow)" cve = "CVE-2024-30085" author = "OnlyFm252" strings: $sync_reg = "CfRegisterSyncRoot" ascii $reparse_ex = "FSCTL_SET_REPARSE_POINT_EX" ascii $cloud_tag = { 1A 60 00 90 } // IO_REPARSE_TAG_CLOUD_6 little-endian $btrp_magic = "BtRp" ascii $ferp_magic = "FeRp" ascii $wnf_spray = "NtCreateWnfStateName" ascii $alpc_spray = "NtAlpcCreateResourceReserve" ascii $pipe_attr = { 3C 00 11 00 } // FSCTL NtFsControlFile pipe attribute condition: uint16(0) == 0x5A4D and 4 of ($sync_reg, $reparse_ex, $cloud_tag, $btrp_magic, $ferp_magic) and 2 of ($wnf_spray, $alpc_spray, $pipe_attr) } ``` ### Sigma rule ```yaml title: CVE-2024-30085 cldflt.sys Heap Overflow Exploitation Attempt id: f8a7c3d1-2024-30085-cldflt-heap status: experimental description: Detects reparse point manipulation on cloud sync root directories, indicative of CVE-2024-30085 exploitation references: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30085 - https://starlabs.sg/blog/2024/12-all-i-want-for-christmas-is-a-cve-2024-30085-exploit/ logsource: product: windows category: file_event detection: selection_reparse: TargetFilename|contains: '\Windows\Temp\' TargetFilename|endswith: - '.tmp' - '.dat' selection_api: CallTrace|contains: - 'CfRegisterSyncRoot' - 'FSCTL_SET_REPARSE_POINT_EX' condition: selection_reparse and selection_api falsepositives: - Legitimate cloud file sync providers (OneDrive, etc.) level: high ``` ### Sysmon config ```xml \Windows\Temp\ OneDrive svchost.exe ``` ## 8. References - MSRC: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30085 - STAR Labs writeup: https://starlabs.sg/blog/2024/12-all-i-want-for-christmas-is-a-cve-2024-30085-exploit/ - Exploit source: https://github.com/star-sg/CVE/tree/master/CVE-2024-30085 - KB5039211 patch: https://support.microsoft.com/en-gb/topic/june-11-2024-kb5039211